European Court of Justice decision seen as another potential FATCA 'game-changer'

“This judgment is a game-changer, perhaps even more than Schrems II,”  Filippo Noseda, pictured left, a Mishcon de Reya law firm partner who has been an outspoken critic of the Foreign Account Tax Compliance Act, on grounds that it violates EU data privacy regulations, told the American Expat Financial News Journal over the weekend. 

"Schrems II" is what a European Court of Justice (ECJ) ruling in July has come to be known as, because it had its origins in a privacy law case involving a 30-something Austrian national named Maximilian Schrems, which ended in a decision that came to be known as Schrems I. 

With Schrems II, the ECJ struck down the main mechanism used by the EU to protect the personal data of EU citizens when it's transferred to the U.S., the so-called "Data Protection Shield", which, as reported, in addition to its potential implications for FATCA, was seen as having major potential implications as well for social media companies like Facebook. 

In July, the question raised by Noseda and others was whether the EU's government and data protection officials would recognize the implications of the Schrems II ruling for such tax-information exchange laws as FATCA, given what they say has been the EU's apparent reluctance – for political reasons, some say – to address it.

FATCA is a U.S. law that came into force in 2014 and obliges banks and other non-U.S. financial institutions to report to the U.S. on all the accounts they hold above a certain amount on behalf of clients who are either U.S. citizens or Green Card holders, no matter where they live in the world. It was intended to enable the U.S. authorities to crack down on U.S.-resident citizens who were taking advantage of foreign institutions to hide their wealth, but it has created massive problems for Americans resident overseas, many of whom now struggle to find banks willing to have them as clients, among other issues. 

Luxembourg 'joined
cases' at issue

Last week's judgment by the ECJ concerned two related cases originating in Luxembourg, known as  "Joined Cases C-245/19 Luxembourg State v B and C-246/19 Luxembourg State v B and Others", and had to do with a request from Spain for information in a tax matter, affecting an individual identified as "F.C.", a "natural person resident in Spain".

The Spanish request for information had been made to  Luxembourg-based "company B and bank A", and concerned "bank accounts and financial assets held or beneficially owned by F.C. and regarding various legal, banking, financial and economic transactions that may have been carried out by F.C. or by third parties acting on her behalf or in her interest". 

The court's ruling in the matter is complex, but according to a summary of the ruling on the ECJ's website, Luxembourg officials saw a case whereby a holder of the information being requested should be able to file a claim against the information order.

Summarizing the decision in a letter a few days later, in a seven-page letter to European Data Protection Board chair Andrea Jelinek, Noseda said the court's decision had declared that "the right to an effective remedy guaranteed by the Charter of Fundamental Rights of the European Union requires that persons who hold information that is requested by the national administration, in the context of a cooperation procedure between [EU] Member States, must be able to bring a direct action against such a request."

In addition, he went on, it had determined that "member states may nevertheless deny the taxpayer subject to the tax investigation and the third parties concerned by the information in question the right to bring such a direct action, provided that there are other remedies enabling them to obtain an incidental review of that request.

"Furthermore, a request for information may relate to categories of information rather than specific information where such categories are defined by criteria establishing their 'foreseeable relevance'."

Noseda said he saw the ECJ's decision in the matter as "particularly significant" because, like FATCA, the case involved "information exchange in tax matters", and because "it was handed down on the same day as [a] Privacy International judgment" that he said was also relevant.

"The publication of the latest [ECJ] judgments in the Luxembourg cases on 6 October 2020 confirms our view that the UK's International Tax Compliance Regulations 2015 infringe the [EU Charter of Fundamental Rights]," Noseda concluded, in his letter to Dr. Jelinek – which he copied to other EU and UK officials, including the European Parliament's Petitions Committee, and the UK's Information Commissioner's Office – "because they do not provide [the financial institutions] with any access to judicial redress".

If the EDPB failed, after this, to intervene with respect to the data protection implications of FATCA, Noseda said, the EDPB would be "abdicating its duties under the GDPR" (European General Data Protection Regulation).

He ended his letter by saying, "Almost one year after we filed a GDPR on behalf of a U.S.-born British national known as Jenny [in connection with FATCA data protection concerns], it is now time for the UK's Information Commissioner to do her job." 

To view Noseda's letter in full, as well as other correspondence in connection with FATCA and other data protection issues, click here.